Episode 4 of The Security Podcast of Silicon Valley aired on June 17, 2021, with Jon McLachlan hosting. The guest was Wesley Belleman, a cyber warfare operator in the California Air National Guard and a system engineer at Palo Alto Networks, after four years in the Air Force (Podbean, LinkedIn). The episode is called “Wesley Belleman of California Air National Guard and Palo Alto Networks: Security Operations Center from Military and Private Industry Perspectives.” It has no video version.
“And then the whole security operations process is just a series of classification problems.”
Wesley Belleman, at 15:20
Wes served in the Air Force from May 2017 to May 2021. His LinkedIn says he owned the requirements for Kraken, a Space Force system for real-time defense against cyber threats, and led a team at United States Southern Command. He joined Palo Alto Networks in May 2021 and the California Air National Guard the same month, part-time (LinkedIn). Jon says on the tape that Wes has been at Palo Alto Networks for two months.
Four months before the episode, Wes published “Classification in Security Operations” in Towards Data Science, the article he brings up on the tape. It breaks a SOC’s work into five decisions, each a classification problem (Towards Data Science).
This page follows the conversation in order: a section for each part of it with the sources beside it, fifteen figures, thirteen clips from the tape, the full transcript, and five tools: a quiz, a scorecard for your security operations, a calculator for the analyst hours that alert triage takes, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
A debt of gratitude
Jon asks for the story behind Wes’s service. Wes says he felt “a debt of gratitude to the military,” so he wanted to join. Once he did, the training and education it gave him helped kickstart his career straight out of college.
He says he has written on LinkedIn about problems with the military’s personnel practices, and that he doesn’t think the military will stay competitive with Silicon Valley. He says that isn’t to bash the military or the people in it. He doesn’t want others to leave for the same reasons he did.
“I want people to stay in, especially talented people, to continue to go to the military and to stay there and build out their careers there and be successful.”
Wesley Belleman, at 2:21
Up or out
Jon asks why he left. Wes says the military still has archaic HR practices. You get pigeonholed into one career, you get little say in where you live, and moving sideways is hard.
“So you kind of get into a very specific career and you get pigeonholed into that career, and they kind of tell you where you’re going to move next.”
Wesley Belleman, at 2:38
Then there’s up or out. Wes says books on cyber defense for the Department of Defense talk about it, such as The Perfect Weapon. David E. Sanger of The New York Times published The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age in 2018 (Wikipedia). People who want to stay hands-on as engineers get pushed into management.
“So the up or out is a problem for some people who want to be more technical.”
Wesley Belleman, at 3:00
Jon expects the military to change, slowly.
“You know, it’s like the larger the organization, the slower the rate of change.”
Jon McLachlan, at 3:29
He adds that this is why startups can be interesting: they change quickly.
What a SOC does
Jon asks Wes to explain a security operations center to listeners who are new to it. Wes says that when he joined the Air Force, he didn’t realize how much of a niche security operations could be, and he found he had to explain it to a lot of people.
His answer starts from monitoring. Logs and network traffic all go somewhere. The question is whether anyone reads them, compares them against signatures of known attacks, and follows up when something matches.
“And they’re actually looking at those logs and they’re actually following those alerts and they’re following up to them”
Wesley Belleman, at 5:27
If they find that an attack worked, they do incident response.
The future, he says, is closing that loop faster: see the alert, investigate, decide whether it had an impact, and respond before the impact grows. Wikipedia describes a SOC as responsible for protecting an organization against threats, with analysts who monitor the network and investigate incidents (Wikipedia).
Police officers inside the network
Jon offers a comparison: the front line, like Navy SEALs, but for cyber warfare. Wes says that’s a good way of looking at it, especially on the defensive side, since Navy SEALs are more offensive. He compares a SOC to your security forces, or your “police officers within your network,” there to keep everybody safe.
Every organization, but how?
Jon asks which organizations should have security operations. Every organization, Wes says. The question is how. A big organization, such as Walmart, can run its own SOC in-house and pay for the analysts and engineers.
“But if you’re a small organization, then you probably want to outsource it to, like, an MSSP.”
Wesley Belleman, at 6:56
A managed security service provider, or MSSP, is a company that provides outsourced network security services (Wikipedia). Wes’s examples are Robert Herjavec’s Herjavec Group and big providers such as IBM. Herjavec, a panelist on Shark Tank, founded The Herjavec Group in 2003 (Wikipedia). Wes says an MSSP cuts costs because it centralizes experts who serve several different tenants. Even for a small company, he would look into one, so a security operations center monitors every endpoint and workload.
Kasparov and the SOC
Jon wonders whether most of this could be automated one day. Wes brings up a book Garry Kasparov wrote about chess and computers, which says the future is a mix of the human and the computer. Kasparov introduced advanced chess, also called centaur chess, in which each human player uses a computer chess engine (Wikipedia). Wes says that may already be untrue in chess, where a human now adds little to a computer, and that the level of complexity in security operations is different.
“from what I’ve seen, that’s really far off.”
Wesley Belleman, at 9:11
“A lot of security operations centers still have yet to implement automation.”
Wesley Belleman, at 9:13
Many SOCs, he says, are still working on getting all their data in one place. He expects a different conversation in five to ten years.
Talking about threats in public
Jon asks what threats Wes saw at the Space Force.
“And as you might imagine, I’m not able to talk about specific threats to space systems.”
Wesley Belleman, at 10:05
He says he saw a push for the government to talk more about threats. Generals who want funding or new priorities need voters who understand why. His example is General Raymond, then Chief of Space Operations, speaking openly about a Chinese satellite with a robotic arm that can grab other satellites. John W. Raymond was the first chief of space operations, from 2019 to 2022 (Wikipedia).
“And he was trying to show people this is why we need to think about defending our satellites.”
Wesley Belleman, at 11:27
Wes hopes more information on cyber threats opens up over the next five to ten years, so voters take it into account at the voting booth.
Physical access means compromise
Jon ties the satellite story to a rule of his own.
“whenever you have a physical compromise of a system, then all of the secrets and everything inside of it, you have to consider them compromised as well.”
Jon McLachlan, at 12:31
He adds that a well-informed public matters for a free society.
A data problem
Jon asks what role data plays in attack detection and response.
“I think the data is starting to become the primary basis upon which people think about probably security overall.”
Wesley Belleman, at 13:01
Wes says books on security operations from the last couple of years start with data engineering and data science concepts, such as what it means for an analytic to be sensitive versus specific. Then they expand into security operations and its data sources.
“So I’ve seen different ways of breaking it up, but the one that I kind of like is network data sources, host data sources and service data sources.”
Wesley Belleman, at 13:49
The three sources flow into a repository, usually some sort of NoSQL database, and the analytics run on that data. Wes says a lot of people still think of it as a security problem. With a background in intrusion detection or prevention systems, they want to write their traditional rules. An intrusion detection system is a device or software application that monitors a network or systems for malicious activity or policy violations (Wikipedia). Friends in data science showed Wes the data view from the outside, and he brought it into his work.
“If you’re trying to find malicious traffic as compared to benign traffic, that’s just a binary classification problem within data science.”
Wesley Belleman, at 15:00
Split the malicious traffic further, into command and control or exfiltration, and each split is a classification problem too.
Five decision points
Jon says that sounds cut out for machine learning.
“So I don’t know if you saw my article on this, but I had kind of five decision points”
Wesley Belleman, at 15:41
He defined each one as a classification problem.
The five decisions in his article are whether data is useful for detection, whether an event is an incident, whether the context data is sufficient, whether it’s a true incident, and how well the mitigation worked. The article defines a cybersecurity incident as “an event that an analyst decided to investigate further” (Towards Data Science). Wes says the article gives his subjective view of how machine learning fits each decision point. Some are a good fit, and a big one that’s becoming common is spam filters.
“And spam filters obviously has a huge impact in the phishing space.”
Wesley Belleman, at 16:04
Natural language processing can judge whether an email looks like phishing. You can’t catch everything, he says, but keeping more phishing emails out of your network makes it less likely that someone exploits it through one. That’s one of the early decision points in his paper: is this an attack, or traffic you can keep allowing through?
Jon says the show will link the article in the description, and the show notes do.
Collaboration across branches
Jon asks whether the branches of the military, and the three-letter agencies, work together on security operations.
“We don’t want to be wasting a lot of resources by duplicating effort.”
Wesley Belleman, at 17:50
Wes says they talked to every branch and to certain agencies, to see what they could pull from each other. The Space Force came out of the Air Force, so most of his collaboration was with the Air Force. Wikipedia says the Space Force was established on December 20, 2019, and is organized as part of the Department of the Air Force (Wikipedia). The collaboration has a cost.
“Sometimes you’re in, like, 10 meetings a day.”
Wesley Belleman, at 18:30
As long as you can manage that alongside building your SOC, he says, the collaboration is important.
Security Onion for hobbyists
Jon asks which tools, open source projects or services help process the data and flag what’s suspicious. Wes starts with the project most people in the security operations community use to get started. He says it’s used more by hobbyists than by big organizations.
“So the Security Onion framework comes with two network sensors, so you can start collecting your network data.”
Wesley Belleman, at 19:45
The sensors are Suricata and Zeek. They feed the Elastic stack, a NoSQL database you view with Kibana. Elastic also has an endpoint log collector, which Wes calls Log Beats, and you point it back at the same Elastic stack. Then your endpoint logs, service logs and network data sit in one place, where you can run queries, build signatures and generate analytics.
“You can kind of detect, like, a whole life cycle of an attack.”
Wesley Belleman, at 20:47
Security Onion is a free Linux distribution for threat hunting, security monitoring and log management, developed by Doug Burks in 2008 (Wikipedia). Vern Paxson began work on Zeek in 1995 (Wikipedia). Suricata, from the Open Information Security Foundation, had its first standard release in July 2010 (Wikipedia). Elasticsearch is a search engine developed by Elastic (Wikipedia), and Kibana is a dashboard for it (Wikipedia). The show notes link Security Onion Solutions.
Test it with Caldera
To validate your own security tools, Wes points to Caldera, an open source project from MITRE built on the MITRE ATT&CK matrix. Jon admits he hasn’t used any of these tools. Caldera has campaigns you run on your own endpoints. You install its agent on an endpoint.
“So you just simulate, okay, bad guy got a zero-day and was able to get some sort of an agent on your endpoint.”
Wesley Belleman, at 21:15
The agent runs tactics from the ATT&CK framework, such as pivoting from one endpoint to another, command and control from a server, or exfiltrating data. Then you look in Security Onion to see what that looks like, and write detections that show up in your Kibana dashboard. ATT&CK is a guideline for classifying and describing cyberattacks and intrusions, created by the Mitre Corporation and released in 2013 (Wikipedia). The show notes link MITRE ATT&CK.
Buy when you can
Jon asks what it takes to move from a hobby setup to something production ready at a large company. Wes says build versus buy was a huge topic and concern of his at the Space Force. A big company can probably afford enough engineers to build everything, but he doesn’t think that’s generally the most efficient way.
“I’m generally, as much as possible, a proponent of buy when you can.”
Wesley Belleman, at 22:45
His example is Elastic. Download Security Onion and you manage your own Elastic cluster. Elastic is also a company, with a cloud-provided Elasticsearch engine that it manages, and professional services. Splunk has similar offerings, he says, and tends to cost more than Elastic.
“at a high level, you get what you pay for.”
Wesley Belleman, at 23:38
Run it yourself and you configure log rotation yourself, for example to keep logs for 30 days. Miss that and logs sit for years until your storage blows up, or one index holds too many and your memory does.
Jon is for buy over build almost every time. He calls himself “the expert of very little in this world,” and a managed service lets him use other people’s expertise without having to worry about it.
“It almost seems like a no-brainer.”
Jon McLachlan, at 24:55
He’s surprised when companies spend a lot of time and money building things that already exist. He wants to spend the time on open technical problems that haven’t been solved yet. Wes agrees.
Two months at Palo Alto Networks
Jon asks about the biggest challenge in the private sector so far, two months in. He says he’d heard people who leave the military describe a cutthroat world of personal performance, and he hasn’t seen that at Palo Alto Networks. He says “it’s very team focused,” and it feels like people care about each other.
The biggest issue for him, he says, was a feeling of instability on leaving government work, which can be more stable on salaries and through the economy. Jon tells him good for him for taking the risk, and adds that you can always go back if it doesn’t work out.
Freedom to turn left or right
Jon asks what the private sector does better. Wes says less security comes with a lot of freedom. He can live where he wants, as long as he can get a job there. He can move laterally, from system engineer to software developer, if he builds the skills and someone will hire him.
In the military, he says, you get on a train track and have to go forward on that track.
“your control is the pedal, right?”
Wesley Belleman, at 29:30
The pedal sets how fast you go along the track, and you can’t turn.
“Versus in the private sector, you can turn left or right if you want to.”
Wesley Belleman, at 29:36
Jon says career paths at large companies have two tracks, and one is the individual contributor, or IC: the engineers and the operations folks.
“And you can climb the ladder just as well as an IC sticking to engineering, and you become an architect.”
Jon McLachlan, at 30:09
Treat people like people
Jon asks what the military does culturally that Wes would like to see more of in the private sector. Wes says the military is as diverse as the private sector, and it depends on where you go. Service branches organize, train and equip, he explains. Combatant commands do the war fighting. A unified combatant command is a joint command of the Department of Defense made up of units from two or more service branches (Wikipedia), and United States Southern Command is one of eleven (Wikipedia). Wes says the work there was more operational.
“everybody felt like a person, like everybody treated me like a person.”
Wesley Belleman, at 32:24
People weren’t there to do their work and go home, he says. They were there to grow relationships and help each other out. He has friends at companies where people punch in, do as much work as possible and punch out, and he says parts of the military are like that too.
“every company should just realize that everyone you work with is a person.”
Wesley Belleman, at 33:05
He says to treat them like a person, be friendly with them, and be kind to them. He sees that attitude at Palo Alto Networks, and says other companies don’t have that mentality.
Celebrate disagreement
Jon agrees.
“I think it’s super important to see people first as people.”
Jon McLachlan, at 33:36
He likes to assume two things about the people he interacts with. They bring something to the table that’s different from what he brings, and they want to do the right thing. So a disagreement means one of two things is about to happen. Someone learns something new about how the world works, or someone sees the world from a new perspective where the problem goes away.
“acknowledge, like, our differences, not as baggage”
Jon McLachlan, at 35:36
We all have different life experiences, he says, and we should see those differences as strengths.
Wes likes the phrase celebrate disagreement, from an article of Jon’s. Some leaders see disagreement as a reason they can’t decide, he says.
“Sometimes disagreement is just part of the process.”
Wesley Belleman, at 36:46
Core values
Wes compares two sets of core values.
“One thing I like about Palo Alto is one of our core values is disruption.”
Wesley Belleman, at 36:53
The Air Force’s core values are integrity first, service before self, and excellence in all we do. Wes calls them great core values that can feel me-centric. Palo Alto Networks’ core values, he says, include disruption, collaboration and inclusion. Disruption is about changing the whole system. The Space Force started with the Air Force’s three, temporarily, and is setting up its own.
Jon expects larger organizations to change slower, and sees an upside for the Space Force.
“Maybe that’s actually a benefit for the Space Force, because it’s new, maybe a little bit smaller.”
Jon McLachlan, at 38:02
The SOC accordion
Jon asks for predictions about the SOC and attack detection. Wes points to Anton Chuvakin, who he says works at Google and was at Gartner for many years, and whose articles and research he has learned from. Chuvakin, Wes says, seems to predict that the SOC could be fully automated at some point. Wes remembers the range Chuvakin gave.
“it might be 2025, it might be 2045.”
Wesley Belleman, at 39:16
The show notes link Chuvakin’s LinkedIn. In a post cross-posted to CISO Platform on March 9, 2021, Chuvakin argues that SOCs can’t and shouldn’t be fully automated today. Then he lays out scenarios that could change that, such as attackers who automate faster, and asks whether his advice still holds in 2025, 2030 or 2035. He gives no firm date (Anton on Security, CISO Platform). Wikipedia lists Chuvakin at Google Cloud’s Office of the CISO, and before that as a research vice president at Gartner (Wikipedia). At Gartner in 2013, he coined the term endpoint threat detection and response (Wikipedia).
Wes says Chuvakin has swayed him a little in that direction. He also expects a lot of change as companies collect more data and learn which data sources are useful.
“I could see the size of SOCs kind of ballooning and then shrinking back and then growing, kind of up and down, like a little accordion.”
Wesley Belleman, at 39:50
A SOC might collect every endpoint log it can think of and add an endpoint protection tool, from Symantec, Palo Alto Networks or another company. Then it finds that a lot of that data doesn’t have much predictive power for attack detection.
Nowhere to Hide
Wes gave a presentation at the Space Force several times called Nowhere to Hide, on security automation. Jon asks whether it’s spelled K-N-O-W or N-O. Wes says N-O, like nowhere. Jon sums it up: you can’t run, and there’s nowhere to hide.
Wes compares it with encryption, since Jon runs an encryption company. Done right, encryption means an adversary who can see your data can’t read it. Nowhere to hide is about what the adversary does.
“if the adversary is doing something that they’re not supposed to be doing, they can’t do that undetected, right?”
Wesley Belleman, at 41:18
They get caught and stopped quickly, he says, and security automation is a huge part of that. SOAR platforms such as Phantom and Palo Alto’s Cortex XSOAR have hundreds of integrations. A SOC with dozens of tools, and tool sprawl, can stop logging in to each one.
“They can bring it all together in a SOAR platform, and then they can start to add playbooks, which are just basically scripts.”
Wesley Belleman, at 41:57
For people who don’t like scripting, a playbook can be visual programming. As automation grows, SOC operations get faster, and operators move out of tier one work, such as opening tickets and closing obvious false positives, toward more complicated threat detection. Security orchestration, automation and response, or SOAR, is a group of technologies that let organizations respond to some incidents automatically (Wikipedia). Phantom was one of a series of companies Splunk acquired between 2013 and 2019 (Wikipedia).
XDR
The other trend Wes expects in the near future is in XDR.
“So XDR is an interesting concept.”
Wesley Belleman, at 42:45
Extended detection and response, he says, does detection and response across the endpoints, the network and other devices, where endpoint detection and response or network detection and response each work within one. Some people could argue it has existed as long as security operations. He counts data loss prevention as part of it. A lot of companies use Red Hat or Windows, so their logs look alike, and most network traffic is probably TCP/IP.
“So if you can correlate Windows logs with TCP/IP, then those analytics that correlate those two different data sources can be shared across different organizations.”
Wesley Belleman, at 43:41
Vendors keep proprietary analytics in their cloud. Customers send their data there, and the analytics send a report back to the customer’s SOC on traffic that looks suspicious. Wes calls the selling of analytics one of the major new trends in the market, along with threat intelligence. Nir Zuk of Palo Alto Networks coined the term XDR in 2018 (Wikipedia).
Threat intelligence
Jon asks whether threat intelligence is the fingerprints that identify specific types of attacks. Wes says yes. An adversary who attacks Palo Alto’s network will want to use that attack on several other networks, to see how many they can compromise.
“Like, ransomware works best if you can hit as many targets as possible and get them all to pay.”
Wesley Belleman, at 44:54
If Palo Alto Networks detects a ransomware attack, and stops it before anything happens, it can share what that attack looks like, so others can make sure it doesn’t hit their environment.
Dwell time
Jon pictures a ransomware crew breaking in, finding the storage and identifying all the backups. That sounds targeted to him, and hard to automate. Wes says some ransomware attacks have been automated, and names the time Jon describes.
“That’s called the dwell time.”
Wesley Belleman, at 45:42
It runs from when the adversary is in your network to when they’re detected. Security automation and more sensors aim to shrink it. His example is SolarWinds. He says it started around June or July 2020 and was detected by CrowdStrike in December 2020, about five or six months of dwell time. Wikipedia says the attack was first publicly reported on December 13, 2020, that the hackers had access for eight to nine months, and that FireEye says it discovered the attack while investigating its own breach (Wikipedia).
Wes also brings up a CrowdStrike report on adversaries’ breakout times, the time you have to detect an adversary to stop them. The fastest adversary on it, he says, had a breakout time of about two hours.
The goal, he says, is to get dwell time down from six months in some cases.
“right down to something that’s measured in hours or minutes.”
Wesley Belleman, at 46:52
More automated, faster, more secure
Jon closes on the future.
“It will be more automated. It’ll be faster.”
Jon McLachlan, at 47:04
It will be more secure too, in no small part because of people like Wes on the front lines. Jon says they’ll have Wes back to see how the predictions work out.
After the tape
Wes stayed at Palo Alto Networks. He is now a cyber security consultant there, a specialist for customers across North America, and he helped write an exam for its new certification program (LinkedIn).
From cyber warfare operator to commander. In the California Air National Guard, Wes was a cyber security manager until February 2025, and he has been a lead cyber planner since March 2023. In April 2026 he became the commander of a 44-person Cyber Protection Team, part of U.S. Cyber Command’s Cyber Mission Force (LinkedIn). U.S. Cyber Command was established on June 23, 2009, and is a unified combatant command (Wikipedia). Since April 2026 he has also been a planner in the 195th Wing’s plans and programs office. The wing’s space units moved to the U.S. Space Force in 2025 (Wikipedia).
Exercises with other organizations. As lead cyber planner, Wes worked on Cyber Dawn 2024 and 2025, CalGuard’s first Amber Mist, and a NATO exercise where his team placed first of eight. His LinkedIn puts Cyber Dawn 2025 at “363 participants across 52 organizations” (LinkedIn).
Kraken in the news. On July 22, 2022, Washington Technology reported that the Space Force’s cyber operations division planned a seven-year cybersecurity services contract called Digital Bloodhound to protect its ground networks. It named two product lines. Manticore duplicates and analyzes data, and Kraken gives more real-time defense against active threats (Washington Technology). Wes’s LinkedIn says he owned the requirements for Kraken.
Splunk became part of Cisco. Cisco agreed to buy Splunk for $28 billion in September 2023 and completed the deal on March 18, 2024 (Wikipedia).
More on this show. On episode 2, a month before this one, Andrew Gontarczyk, then the CISO of Pure Storage, calls the blue team the security operations center. For security data, listen to episode 50 with Alan Braithwaite of RunReveal on SIEM, and episode 63 with Kabir Mathur of Leen on why security tools don’t talk to each other. For threat intelligence, listen to episode 12 with Dan Sherry and Grace Chi of Pulsedive. On episode 90, Garrett Smith of Reveal Technology talks about building for the military.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it, and where it is on the tape.
-
What does Wes say the whole security operations process is?
- A series of classification problems
- A set of compliance checklists
- A job for one analyst per network
a. "And then the whole security operations process is just a series of classification problems." Transcript, 15:20.
-
Which two network sensors come with Security Onion, according to Wes?
- Snort and Wireshark
- Suricata and Zeek
- Kibana and Splunk
b. "So that's Suricata and Zeek." Transcript, 19:51.
-
What does Wes suggest for validating your own security tools?
- A yearly bug bounty
- A vendor's demo environment
- MITRE's open source project Caldera
c. "And then to validate your own security tools, MITRE has a really cool open source project called Caldera." Transcript, 20:52.
-
Where does Wes stand on build versus buy?
- Buy when you can
- Always build it yourself
- Build first, buy later
a. "I'm generally, as much as possible, a proponent of buy when you can." Transcript, 22:45.
-
On Wes's military train track, what do you control?
- The steering wheel
- The pedal
- The next station
b. "your control is the pedal, right?" Transcript, 29:30.
-
What did Wes call the presentation he gave at the Space Force several times?
- Defense in Depth
- Assume Breach
- Nowhere to Hide
c. "So I have a presentation I gave in the Space Force several times called Nowhere to Hide." Transcript, 40:39.
-
What does Wes call the time from an adversary getting into your network to being detected?
- Dwell time
- Breakout time
- Patch window
a. "That's called the dwell time." Transcript, 45:42.
Is there nowhere to hide on your network?
Wes’s answers add up to a checklist for security operations. Eight questions on how much of it you have today.
Scorecard · eight questions
Is there nowhere to hide on your network?
Answer for the systems that matter most. If two answers fit, pick the lower one.
-
Does someone read your alerts and follow up on them every day?
- No
- When there's time
- Yes, with a named owner
"And is anybody really reading it?" See What a SOC does.
-
Do your network, host and service data land in one place?
- No
- Two of the three
- All three
"They're still just kind of grappling their hands around getting all the data in one place." See Kasparov and the SOC.
-
Who watches your endpoints and workloads?
- Nobody
- Our team, in business hours
- A SOC, in-house or an MSSP
"But if you're a small organization, then you probably want to outsource it to, like, an MSSP." See Every organization, but how?
-
Have you run a simulated attacker against your own detections?
- Never
- Once
- On a schedule
"And then to validate your own security tools, MITRE has a really cool open source project called Caldera." See Test it with Caldera.
-
Do you know how long you keep your logs, and who manages that?
- No
- Roughly
- Yes, set and owned
"because you might only want your logs to stay there for 30 days." See Buy when you can.
-
Are the routine triage steps automated with playbooks?
- None
- A few
- Most tier one work
"and then they can start to add playbooks, which are just basically scripts." See Nowhere to Hide.
-
Do you run detections across endpoints, the network and other sources together?
- No
- Partly
- Yes
"And so bringing all those data sources together" See XDR.
-
Do you know the dwell time of your last incident?
- No
- Estimated
- Measured
"is to shrink that dwell time as much as possible." See Dwell time.
An attacker could sit in your network for months. Start by naming who reads the alerts, and get your network, host and service data into one place.
The data is there. Next, test your detections with a simulated attacker and automate the triage steps your team repeats most.
You watch, test and automate. Keep measuring dwell time, and add the data sources that prove useful.
How many analyst hours does triage take?
Wes says playbooks move analysts out of tier one work, such as closing obvious false positives. This calculator shows how many analyst hours your alerts take each day, and how many automation gives back.
Calculator
How many analyst hours does triage take?
Three numbers: alerts a day, minutes to triage one, and the share a playbook handles.
With 400 alerts a day at 6 minutes each, triage takes 24.0 analyst hours a day, or 3.0 analysts on eight-hour shifts. Playbooks give back 16.0 hours a day.
The 400 alerts, 6 minutes and 40% are our example. Put in your own numbers.
From Zeek in 1995 to a Cyber Protection Team in 2026
The tools Wes names, the ideas behind them, his path, and the events around them. Filter by topic.
Timeline
From Zeek in 1995 to a Cyber Protection Team in 2026
- Zeek
Vern Paxson begins work on the network analysis framework (Wikipedia, on this show).
- Security Onion
Doug Burks develops the Linux distribution for threat hunting and security monitoring (Wikipedia, on this show).
- U.S. Cyber Command
Established as a sub-unified command (Wikipedia).
- Suricata
The first standard release, from the Open Information Security Foundation (Wikipedia, on this show).
- ATT&CK
The Mitre Corporation releases its guideline for classifying cyberattacks and intrusions (Wikipedia, on this show).
- Endpoint detection
Anton Chuvakin of Gartner coins endpoint threat detection and response (Wikipedia).
- Air Force
Wes starts as a project manager, through May 2021 (LinkedIn).
- XDR
Nir Zuk of Palo Alto Networks coins the term (Wikipedia, on this show).
- The Perfect Weapon
David E. Sanger publishes The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age (Wikipedia, on this show).
- Space Force
The service is established, as part of the Department of the Air Force (Wikipedia, on this show).
- SolarWinds
The attack is first publicly reported (Wikipedia, on this show).
- Classification in Security Operations
Wes's article breaks a SOC into five classification decisions (Towards Data Science, on this show).
- Humans in the SOC
Anton Chuvakin argues SOCs can't be fully automated today, and asks whether that holds in 2025, 2030 or 2035 (CISO Platform, on this show).
- Palo Alto Networks
Wes joins Palo Alto Networks and the California Air National Guard (LinkedIn).
- Episode 2
Andrew Gontarczyk calls the blue team the security operations center (episode 2).
- Episode 4
Wes on the show, two months into Palo Alto Networks (on this show).
- Digital Bloodhound
Washington Technology reports the Space Force contract plan, with Manticore and Kraken (Washington Technology).
- Lead cyber planner
Wes's role in the California Air National Guard, with Cyber Dawn and a NATO exercise (LinkedIn).
- Cisco and Splunk
Cisco completes its $28 billion purchase of Splunk (Wikipedia, on this show).
- Space units move
The 195th Wing's space units move to the U.S. Space Force (Wikipedia).
- Cyber Dawn 2025
363 participants across 52 organizations, in Wes's LinkedIn (LinkedIn).
- Episode 90
Garrett Smith of Reveal Technology on building for the military (episode 90).
- Cyber Protection Team
Wes takes command of a 44-person team in U.S. Cyber Command's Cyber Mission Force (LinkedIn).
What to do this week
Five things, in the order of the episode.
- Name who reads the alerts. Write down who follows up on each kind of alert today, and when. Take the scorecard with your team. Our Monitoring and Response team can do the watching if nobody has the job.
- Put the data in one place. List your network, host and service data sources and where each one lands. Check how long you keep the logs and who manages that.
- Test one detection. Run one ATT&CK technique on a test endpoint with Caldera and check that an alert fires. A penetration test shows what a real attacker would try.
- Count your triage hours. Run the calculator with your own alert numbers, then write playbooks for the steps your analysts repeat most.
- Get a second pair of eyes. A vCISO can own the plan, and you can book 15 minutes with us.